fix(kyberforge): stop the provenance checker skipping check 8 on unparsed input

484357a taught the Contributing parser the bullet form, but a block it still
could not parse returned the same empty result as an explicit "(none)", so the
checker read "no contributing files" and skipped check 8 rather than reporting
that it could not tell. Checks 7 and 8 were consequently dead across the whole
git plugin without anything failing.

The parser now distinguishes "declared none" from "could not parse", which
wakes both checks. Because the parser is duplicated between the skill-audit and
agent-audit copies, it is fenced with BEGIN/END markers and a test hashes the
two regions so the copies cannot drift apart again silently.

Addresses #111.

tests/test-adr0020-contract.sh

@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Regression test for the three STRUCTURAL claims the ADR-0020 gate family makes
-# about itself. None of them was pinned anywhere before this file, and each one
-# fails silently — which is the whole reason they need a test rather than a
-# comment:
+# Regression test for the STRUCTURAL claims the ADR-0020 gate family makes about
+# itself. None of them was pinned anywhere before this file, and each one fails
+# silently — which is the whole reason they need a test rather than a comment:
 #
 #   1. "ONE resolver, embedded VERBATIM in three scripts." The block between the
 #      BEGIN/END markers is copied, not imported, because a cache-installed
@@ -11,6 +10,10 @@
 #      one-line edit to a single copy is invisible: every constant-agreement
 #      assertion in tests/test-skill-size-check.sh still passes, because the
 #      CONSTANTS are not what drifted.
+#   1b. The same claim, one directory over, for the Contributing-files parser
+#      embedded in both validate-provenance.sh copies. That one was worse: the
+#      agent-audit copy's docstring ASSERTED it was kept behaviourally identical
+#      to skill-audit's, and the two had already drifted.
 #   2. Both interpreter preflights, in all three scripts. python3 and PyYAML are
 #      declared HARD dependencies precisely so a missing one cannot turn into a
 #      vacuous pass, and the two are checked separately so the message names the
@@ -93,6 +96,69 @@ else
   fi
 fi
 
+# ---------------------------------------------------------------------------
+# 1b. The shared Contributing-files parser is byte-identical in both copies
+# ---------------------------------------------------------------------------
+# Same defect class, one directory over. parse_contributing_files() is embedded
+# in both validate-provenance.sh copies for the same reason the resolver is
+# embedded three times, and until this assertion existed the agent-audit copy's
+# docstring merely CLAIMED it was "kept behaviourally identical to skill-audit's
+# copy" — an invariant nothing checked, and the two had already drifted into
+# different spellings of the bullet loop. The parser decides whether checks 4,
+# 5 and 8 run at all, so a one-sided edit disables a check in one script while
+# every other test stays green.
+echo ""
+echo "--- the shared Contributing-files parser is byte-identical in both validate-provenance.sh copies ---"
+
+CF_BEGIN='# ===== BEGIN SHARED CONTRIBUTING-FILES PARSER ====='
+CF_END='# ===== END SHARED CONTRIBUTING-FILES PARSER ====='
+SKILL_PROV="$REPO_ROOT/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate-provenance.sh"
+AGENT_PROV="$REPO_ROOT/plugins/kyberforge/.apm/skills/agent-audit/scripts/validate-provenance.sh"
+
+CF_MARKERS_OK=true
+for f in "$SKILL_PROV" "$AGENT_PROV"; do
+  if [[ ! -f "$f" ]]; then
+    fail "script not found: $f"
+    CF_MARKERS_OK=false
+    continue
+  fi
+  b="$(grep -cFx "$CF_BEGIN" "$f" || true)"
+  e="$(grep -cFx "$CF_END" "$f" || true)"
+  if [[ "$b" == "1" && "$e" == "1" ]]; then
+    pass "${f#"$REPO_ROOT/"} carries exactly one BEGIN and one END parser marker"
+  else
+    fail "${f#"$REPO_ROOT/"} has $b BEGIN and $e END parser markers, expected 1 and 1"
+    CF_MARKERS_OK=false
+  fi
+done
+
+if ! $CF_MARKERS_OK; then
+  fail "skipping the parser byte-identity comparison — the marker pairs are not well-formed, so any extraction would measure the wrong span"
+else
+  CF_HASHES=()
+  CF_LINECOUNTS=()
+  for f in "$SKILL_PROV" "$AGENT_PROV"; do
+    out="$TMPDIR_T/cfblock-$(echo "$f" | md5sum | cut -c1-8).txt"
+    sed -n "/^${CF_BEGIN}\$/,/^${CF_END}\$/p" "$f" > "$out"
+    CF_HASHES+=("$(md5sum < "$out" | cut -d' ' -f1)")
+    CF_LINECOUNTS+=("$(wc -l < "$out" | tr -d ' ')")
+  done
+  if [[ "${CF_HASHES[0]}" == "${CF_HASHES[1]}" ]]; then
+    pass "both copies hash to ${CF_HASHES[0]} (${CF_LINECOUNTS[0]} lines) — agreement by construction, not by coincidence"
+  else
+    fail "the shared Contributing-files parser has DRIFTED: skill-audit=${CF_HASHES[0]} (${CF_LINECOUNTS[0]} lines), agent-audit=${CF_HASHES[1]} (${CF_LINECOUNTS[1]} lines). Edit one copy, then paste it over the other."
+  fi
+  # Two identical EMPTY spans would hash equal and assert nothing, exactly as
+  # for the resolver above. The parser block is ~93 lines; 40 is a floor low
+  # enough never to need maintenance and high enough that a gutted block — or
+  # one reduced to its docstring — cannot sneak past.
+  if [[ "${CF_LINECOUNTS[0]}" -gt 40 ]]; then
+    pass "the extracted parser block is ${CF_LINECOUNTS[0]} lines — the comparison is over real content, not an empty span"
+  else
+    fail "the extracted parser block is only ${CF_LINECOUNTS[0]} lines — two identical empty spans would compare equal and assert nothing"
+  fi
+fi
+
 # ---------------------------------------------------------------------------
 # 2. Both interpreter preflights, in all three scripts
 # ---------------------------------------------------------------------------